Windows Server 2003 Service Pack 1

In Service Pack 1 for Windows Server 2003 Microsoft changed the defaults for which user-groups are able to access DCOM objects on the server from a workstation. This change causes non-administrators to be unable to access the InnoCielo services (EDM Server, License Server).

Accessing the EDM Server

To allow non-administrators to access the InnoCielo services, add the appropriate group of InnoCielo users is to the local "Distributed COM Users" group on the server. This will allow that user group to access DCOM services on the server.

Running the License Server on a different server

If the InnoCielo License Server is running on a different server than the InnoCielo EDM Server, the EDM Server will now be denied access to that license server. To enable the use of this configuration again, create a special account under which the EDM Server will be run. Then change the "Log On" account for the InnoCielo EDM Server service to this account.

• On the machine running the EDM Service this account needs to have full control over the folder containing the Vaults, and the registry tree HKEY_LOCAL_MACHINE\Software\Cyco.
• On the machine running the License Servcer this account should be member of the "Distributed COM Users" group.

Preliminary testing on SP1 has indicated the following issue:

In Service Pack 1 for Windows Server 2003 a security change was made that results in non-administrators not being able to open a vault. This is caused by the fact that the Local System Account (SYSTEM) is now more restricted than previously. The solution is to run the AutoManager services (AutoManager EDM Server, AutoManager License Server and AutoManager Filesystem Server) under a special account with administrative privileges.

To do this, open the Services control panel applet, and open the Properties of the service. Choose the "Log on" tab, and change the option from "Local System account" to "This account" and enter the appropriate account information.